From b5c8330502acb89ef16d1b5b33e6d693d4d9d58d Mon Sep 17 00:00:00 2001
From: Christer Edwards <christer.edwards@gmail.com>
Date: Mon, 25 Nov 2019 15:38:40 -0700
Subject: [PATCH] add PATH; improve firewall

---
 README.md                         |  5 ++---
 usr/local/bin/bastille            |  2 ++
 usr/local/share/bastille/start.sh |  4 ++--
 usr/local/share/bastille/stop.sh  | 11 ++++++-----
 4 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index b953700..c44ec59 100644
--- a/README.md
+++ b/README.md
@@ -94,9 +94,7 @@ First, create the loopback interface:
 ```shell
 ishmael ~ # sysrc cloned_interfaces+=lo1
 ishmael ~ # sysrc ifconfig_lo1_name="bastille0"
-ishmael ~ # sysrc ifconfig_bastille0_aliases="inet 10.17.89.1/32"
 ishmael ~ # service netif cloneup
-ishmael ~ # ifconfig bastille0 inet 10.17.89.1/32
 ```
 
 Second, enable the firewall:
@@ -116,7 +114,8 @@ set block-policy return
 scrub in on $ext_if all fragment reassemble
 
 set skip on lo
-nat on $ext_if from bastille0:network to any -> ($ext_if)
+table <jails> persist
+nat on $ext_if from <jails> to any -> ($ext_if)
 
 ## rdr example
 ## rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45
diff --git a/usr/local/bin/bastille b/usr/local/bin/bastille
index cf4292f..db2aa0e 100755
--- a/usr/local/bin/bastille
+++ b/usr/local/bin/bastille
@@ -28,6 +28,8 @@
 # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+
 ## root check first.
 bastille_root_check() {
     if [ $(id -u) -ne 0 ]; then
diff --git a/usr/local/share/bastille/start.sh b/usr/local/share/bastille/start.sh
index 4ce681d..a3d1a27 100644
--- a/usr/local/share/bastille/start.sh
+++ b/usr/local/share/bastille/start.sh
@@ -67,9 +67,9 @@ for _jail in ${JAILS}; do
         echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
         jail -f "${bastille_jailsdir}/${_jail}/jail.conf" -c ${_jail}
 
-        ## update ${bastille_jail_loopback}:network with added/removed addresses
+        ## update table:jails in firewall with container address
         if [ ! -z ${bastille_jail_loopback} ]; then
-            pfctl -f /etc/pf.conf
+            pfctl -t jails -T add $(jls -j ${_jail} ip4.addr)
         fi
     fi
     echo
diff --git a/usr/local/share/bastille/stop.sh b/usr/local/share/bastille/stop.sh
index 004a897..1b8bac7 100644
--- a/usr/local/share/bastille/stop.sh
+++ b/usr/local/share/bastille/stop.sh
@@ -64,13 +64,14 @@ for _jail in ${JAILS}; do
 
     ## test if running
     elif [ $(jls name | grep -w "${_jail}") ]; then
+        ## remove ip4.addr from firewall table:jails
+        if [ ! -z ${bastille_jail_loopback} ]; then
+            pfctl -t jails -T delete $(jls -j ${_jail} ip4.addr)
+        fi
+
+        ## stop container
         echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
         jail -f "${bastille_jailsdir}/${_jail}/jail.conf" -r ${_jail}
-
-        ## update ${bastille_jail_loopback}:network with added/removed addresses
-        if [ ! -z ${bastille_jail_loopback} ]; then
-            pfctl -f /etc/pf.conf
-        fi
     fi
     echo
 done